This release is a pre-release and may not be stable for production use.
Sogen exposes Python bindings for Windows and Linux userspace emulation. The Python API is meant for scripting runs, building small analysis helpers, and quickly iterating on callbacks; Windows bindings also expose hooks for deeper analysis.
Install from PyPI:
pip install sogen
Project links:
- PyPI: https://pypi.org/project/sogen/
- Repository: https://github.com/momo5502/sogen
- Ready-made emulation root: https://sogen.dev/root.zip
What you need
The Python package still needs an emulation root at runtime. Download ready-made root here:
Extract it somewhere convenient, for example:
./root
Most examples in this document use:
emulation_root="./root"
Quick start
import sogen
app = sogen.windows.create_application(
"c:/test-sample.exe",
emulation_root="./root",
)
app.callbacks.on_stdout = lambda text: print(text, end="")
app.start()
print("exit status:", app.process.exit_status)
Linux quick start:
import sogen
app = sogen.linux.create_application(
"/bin/true",
emulation_root="/",
backend=sogen.Backend.unicorn,
)
app.start()
print("exit status:", app.process.exit_status)
sogen.linux does not use the root-level sogen.create_application(...) compatibility alias.
Minimal example with file + port mappings
from pathlib import Path
import sogen
app = sogen.windows.create_application(
"c:/test-sample.exe",
emulation_root="./root",
path_mappings={"c:/a.txt": Path("./a.txt")},
port_mappings={28970: 28980},
)
app.callbacks.on_stdout = lambda text: print(text, end="")
app.start()
print("exit status:", app.process.exit_status)
Choosing backend
sogen.windows.create_empty(), sogen.windows.create_application(), and sogen.linux.create_application() accept backend=sogen.Backend.unicorn.
import sogen
emu = sogen.windows.create_empty(
emulation_root="./root",
backend=sogen.Backend.unicorn,
)
Available values:
sogen.Backend.unicornsogen.Backend.iciclesogen.Backend.whp(Windows)sogen.Backend.kvm(Linux x86_64)
Default is sogen.Backend.unicorn.
High-level structure
Windows entry points:
sogen.windows.create_empty(...)sogen.windows.create_application(...)
Linux entry point:
sogen.linux.create_application(...)
Windows compatibility aliases currently remain at top level:
sogen.create_empty(...)sogen.create_application(...)
Objects exposed by the Windows bindings:
sogen.windows.Emulator/sogen.windows.WindowsEmulatorProcessContextThreadMemoryManagerHooksCallbacks
Linux-specific objects exposed by the bindings:
sogen.linux.Emulator/sogen.linux.LinuxEmulatorsogen.linux.ProcessContextsogen.linux.MemoryManagersogen.linux.Callbacks
Common Windows workflows:
- run application with
app.start() - watch output with
app.callbacks.on_stdout - react to module loads with
app.callbacks.on_module_load - intercept WinAPI calls with
app.hooks.apis[...] - read/write emulator memory with
read_memory()/write_memory() - save and restore state with
save_snapshot()/restore_snapshot()
Callbacks
Example: print loaded modules.
import sogen
app = sogen.windows.create_application(
"c:/test-sample.exe",
emulation_root="./root",
)
def on_module_load(module):
print(f"loaded {module.name} @ 0x{module.entry_point:x}")
app.callbacks.on_module_load = on_module_load
app.start()
Useful callback slots include:
app.callbacks.on_stdoutapp.callbacks.on_syscallapp.callbacks.on_memory_violateapp.callbacks.on_module_loadapp.callbacks.on_module_unload
API hooks
API hooks are registered through app.hooks.apis.
Use @sogen.windows.api_call(...) to describe calling convention and parameters.
Top-level sogen.api_call(...) remains as compatibility alias.
Observe API call, then run original
import ctypes
import sogen
app = sogen.windows.create_application(
"c:/test-sample.exe",
emulation_root="./root",
)
@sogen.windows.api_call(cc=sogen.CallingConvention.stdcall, params=[ctypes.c_uint32])
def on_sleep(call, params):
print(f"Sleep({params[0]})")
app.hooks.apis["Sleep"] = on_sleep
app.start()
Intercept API call and return custom value
import sogen
app = sogen.windows.create_application(
"c:/hook-sample.exe",
emulation_root="./root",
)
@sogen.windows.api_call(cc=sogen.CallingConvention.stdcall, params=[])
def on_get_current_process_id(call, params):
call.return_value = 0xC0FFEE01
return sogen.ApiContinuation.intercept
app.hooks.apis["GetCurrentProcessId"] = on_get_current_process_id
app.start()
print(app.process.exit_status)
Hook keys can be either:
- bare API name, for example
"Sleep" - qualified module form, for example
"kernel32!Sleep"
Memory and state
The emulator exposes direct state access.
import sogen
emu = sogen.windows.create_empty(emulation_root="./root")
base = emu.memory.allocate_memory(0x1000, sogen.MemoryPermission.read_write)
emu.write_memory(base, b"ABCD")
print(emu.read_memory(base, 4))
state = emu.serialize_state()
emu.write_memory(base, b"WXYZ")
emu.deserialize_state(state)
print(emu.read_memory(base, 4))
For checkpoint-style workflows, use snapshots:
emu.save_snapshot()
# ... mutate state ...
emu.restore_snapshot()
Examples
Small runnable examples:
examples/python/basic_usage.pyfor Windowsexamples/python/linux_true.pyfor Linux
Example setup notes:
examples/python/README.md
Current limitations / expectations
- Windows bindings require an emulation root
- Windows samples in this repo assume Windows-style guest paths like
c:/... - Windows workflows are easiest to validate against repo sample binaries such as
test-sample.exeandhook-sample.exe - backend availability depends on platform and how Sogen was built
1 maintainer
Metadata
1 maintainer
Release files for sogen 0.0.1.dev4399
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| sogen-0.0.1.dev4399.tar.gz | 46.3 MB | Details |
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| sogen-0.0.1.dev4399-cp39-cp39-win_amd64.whl | CPython 3.9 | CPython 3.9 | Windows x86-64 | Details |
| sogen-0.0.1.dev4399-cp39-cp39-manylinux_2_39_x86_64.whl | CPython 3.9 | CPython 3.9 | Linux glibc 2.39+ x86-64 | Details |
| sogen-0.0.1.dev4399-cp39-cp39-macosx_11_0_arm64.whl | CPython 3.9 | CPython 3.9 | macOS 11.0+ ARM64 | Details |
| sogen-0.0.1.dev4399-cp39-cp39-macosx_10_13_x86_64.whl | CPython 3.9 | CPython 3.9 | macOS 10.13+ x86-64 | Details |
Total release size: 73.3 MB
Release files / sogen-0.0.1.dev4399.tar.gz
| Download URL | sogen-0.0.1.dev4399.tar.gz |
|---|---|
| Size | 46.3 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
1a06818cee2e398ae84d47b3678b8dbba4fbaf90175f8ba25b9022b3a590d605
|
|
BLAKE2b-256 checksum How to use checksums |
3c2bcd9a30b801832dc2c4dcc7ba5435b93183dd6d0969bca4614c3a6cffc0d5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 29, 2026.
Transparency logRelease files / sogen-0.0.1.dev4399-cp39-cp39-win_amd64.whl
| Download URL | sogen-0.0.1.dev4399-cp39-cp39-win_amd64.whl |
|---|---|
| Size | 5.1 MB |
| Tags | CPython 3.9 Windows x86-64 |
|
SHA-256 checksum How to use checksums |
011bd9741cfee8fedda2ff692457c7f5fb69996de66a4e09f5244c13acf4ba85
|
|
BLAKE2b-256 checksum How to use checksums |
bdd5207fc933074353b7ec13a699a9359239db0dd653f4263e2be978c64aa7fd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 29, 2026.
Transparency logRelease files / sogen-0.0.1.dev4399-cp39-cp39-manylinux_2_39_x86_64.whl
| Download URL | sogen-0.0.1.dev4399-cp39-cp39-manylinux_2_39_x86_64.whl |
|---|---|
| Size | 8.9 MB |
| Tags | CPython 3.9 Linux glibc 2.39+ x86-64 |
|
SHA-256 checksum How to use checksums |
7eac1c456f9e3267cf246d984de315b820d40b59935820479313e353263a31e2
|
|
BLAKE2b-256 checksum How to use checksums |
dc2ca169692716453447afea87b9e78bde6bdef8e6a9eb036ee0d06b30623331
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 29, 2026.
Transparency logRelease files / sogen-0.0.1.dev4399-cp39-cp39-macosx_11_0_arm64.whl
| Download URL | sogen-0.0.1.dev4399-cp39-cp39-macosx_11_0_arm64.whl |
|---|---|
| Size | 6.0 MB |
| Tags | CPython 3.9 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
94e11b1277ec810de78dffdd1e8e1376cde7845c4dab51eff2200b8d3c25065e
|
|
BLAKE2b-256 checksum How to use checksums |
91bc7479f6adc7f4d1ca4c085f048a82bffd61f83d6d51817f8c2f9dac1aecbd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 29, 2026.
Transparency logRelease files / sogen-0.0.1.dev4399-cp39-cp39-macosx_10_13_x86_64.whl
| Download URL | sogen-0.0.1.dev4399-cp39-cp39-macosx_10_13_x86_64.whl |
|---|---|
| Size | 7.0 MB |
| Tags | CPython 3.9 macOS 10.13+ x86-64 |
|
SHA-256 checksum How to use checksums |
f4b36c9e528ddb563318a3d51e9eaaf8686c21a489916d007a6fad8a9155dd99
|
|
BLAKE2b-256 checksum How to use checksums |
de64dd7fcdb09ade66144620d6873fdab1f50d90c0e091aed32b5fc00c12c3a7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 29, 2026.
Transparency log
